Thanks to visit codestin.com
Credit goes to github.com

Skip to content

SEC: fix security breaches in GHA workflows detected with zizmor#17315

Merged
pllim merged 3 commits into
astropy:mainfrom
neutrinoceros:mnt/sec/fix_zizmor_detected_breaches
Nov 26, 2024
Merged

SEC: fix security breaches in GHA workflows detected with zizmor#17315
pllim merged 3 commits into
astropy:mainfrom
neutrinoceros:mnt/sec/fix_zizmor_detected_breaches

Conversation

@neutrinoceros

@neutrinoceros neutrinoceros commented Nov 4, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description

This fixes a couple security issues I found using zizmor.

One more issue remains unadressed because I do not understand what the problem is or how to address it. Here's the current output:

❯ zizmor .github/workflows
🌈 completed ci_cron_daily.yml
🌈 completed check_milestone.yml
🌈 completed publish.yml
🌈 completed ci_benchmark.yml
🌈 completed codeql-analysis.yml
🌈 completed update_astropy_iers_data_pin.yml
🌈 completed stalebot.yml
🌈 completed ci_cron_weekly.yml
🌈 completed open_actions.yml
🌈 completed CFF-test.yml
🌈 completed check_changelog.yml
🌈 completed ci_workflows.yml
error[dangerous-triggers]: use of fundamentally insecure workflow trigger
 --> /Users/clm/dev/astropy-project/coordinated/astropy/.github/workflows/open_actions.yml:3:1
  |
3 | / on:
4 | |   issues:
... |
8 | |     types:
9 | |     - opened
  | |____________^ pull_request_target is almost always used insecurely
  |

1 findings (0 unknown, 0 informational, 0 low, 0 medium, 1 high)
  • By checking this box, the PR author has requested that maintainers do NOT use the "Squash and Merge" button. Maintainers should respect this when possible; however, the final decision is at the discretion of the maintainer that merges the PR.

@neutrinoceros neutrinoceros requested a review from a team November 4, 2024 07:45
@github-actions

github-actions Bot commented Nov 4, 2024

Copy link
Copy Markdown
Contributor

Thank you for your contribution to Astropy! 🌌 This checklist is meant to remind the package maintainers who will review this pull request of some common things to look for.

  • Do the proposed changes actually accomplish desired goals?
  • Do the proposed changes follow the Astropy coding guidelines?
  • Are tests added/updated as required? If so, do they follow the Astropy testing guidelines?
  • Are docs added/updated as required? If so, do they follow the Astropy documentation guidelines?
  • Is rebase and/or squash necessary? If so, please provide the author with appropriate instructions. Also see instructions for rebase and squash.
  • Did the CI pass? If no, are the failures related? If you need to run daily and weekly cron jobs as part of the PR, please apply the "Extra CI" label. Codestyle issues can be fixed by the bot.
  • Is a change log needed? If yes, did the change log check pass? If no, add the "no-changelog-entry-needed" label. If this is a manual backport, use the "skip-changelog-checks" label unless special changelog handling is necessary.
  • Is this a big PR that makes a "What's new?" entry worthwhile and if so, is (1) a "what's new" entry included in this PR and (2) the "whatsnew-needed" label applied?
  • At the time of adding the milestone, if the milestone set requires a backport to release branch(es), apply the appropriate "backport-X.Y.x" label(s) before merge.

@github-actions

github-actions Bot commented Nov 4, 2024

Copy link
Copy Markdown
Contributor

👋 Thank you for your draft pull request! Do you know that you can use [ci skip] or [skip ci] in your commit messages to skip running continuous integration tests until you are ready?

@neutrinoceros neutrinoceros force-pushed the mnt/sec/fix_zizmor_detected_breaches branch from fdd7f82 to 6f819a8 Compare November 4, 2024 09:47
@neutrinoceros neutrinoceros added this to the v6.1.5 milestone Nov 4, 2024
@neutrinoceros neutrinoceros marked this pull request as ready for review November 4, 2024 09:48
@pllim

pllim commented Nov 4, 2024

Copy link
Copy Markdown
Member

error[dangerous-triggers]

Well, not like I did it for fun. We need extra access to post comment on PR. Will the zizmor dev able to give advice?

@pllim pllim added the Extra CI Run cron CI as part of PR label Nov 4, 2024
pllim
pllim reviewed Nov 4, 2024
View reviewed changes
Comment thread .github/workflows/update_astropy_iers_data_pin.yml

@pllim pllim Nov 4, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not really a way to check this on PR but I can probably do a trigger after merge if necessary.

@neutrinoceros

neutrinoceros commented Nov 4, 2024

Copy link
Copy Markdown
Contributor Author

Apparently he's very reactive yes. So I heard.

@WilliamJamieson

WilliamJamieson commented Nov 4, 2024

Copy link
Copy Markdown
Contributor

Do we want to add this to the pre-commit? https://github.com/woodruffw/zizmor/blob/a3e84e6564e6025ce4c5e7bb3ab024d5dbf62901/docs/usage.md?plain=1#L106-L130

@pllim

pllim commented Nov 4, 2024

Copy link
Copy Markdown
Member

pre-commit

Is that necessary? We do not add new workflows often.

@pllim

pllim commented Nov 4, 2024

Copy link
Copy Markdown
Member

very reactive yes

Is that good or bad? 😅

@neutrinoceros

neutrinoceros commented Nov 4, 2024

Copy link
Copy Markdown
Contributor Author

Do we want to add this to the pre-commit?

oooh I didn't see there was a pre-commit hook already.

Is that necessary? We do not add new workflows often.

Sure, but zizmor might add new checks in the future (the tool is extremely new), that we might want to know about sooner rather than later.

Is that good or bad?

good !

@bsipocz bsipocz modified the milestones: v6.1.5, v6.1.7 Nov 12, 2024
@saimn saimn modified the milestones: v6.1.7, v7.0.1 Nov 22, 2024
@neutrinoceros

neutrinoceros commented Nov 26, 2024

Copy link
Copy Markdown
Contributor Author

zizmor 0.6 now supports # zizmor: ignore[rule] comments, so, we could leverage it to ignore the one dangerous-triggers violation we have and add the pre-commit hook to catch future breaches !

@pllim

pllim commented Nov 26, 2024

Copy link
Copy Markdown
Member

I guess doesn't hurt...

@neutrinoceros neutrinoceros force-pushed the mnt/sec/fix_zizmor_detected_breaches branch from 6f819a8 to a04f23c Compare November 26, 2024 15:49
WilliamJamieson
WilliamJamieson reviewed Nov 26, 2024
View reviewed changes

@WilliamJamieson WilliamJamieson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems reasonable to me.

@neutrinoceros

neutrinoceros commented Nov 26, 2024

Copy link
Copy Markdown
Contributor Author

pre-commit.ci is having issues building zizmor 0.6.0 (and I have to confess I did to; I needed to update rust on my system), so I guess we should hold on that pre-commit hook...

@neutrinoceros neutrinoceros force-pushed the mnt/sec/fix_zizmor_detected_breaches branch from a04f23c to e1357a3 Compare November 26, 2024 16:06
pllim
pllim approved these changes Nov 26, 2024
View reviewed changes

@pllim pllim left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

If you want, feel free to open follow up issue for the pre-commit.

@pllim pllim merged commit 803c7bd into astropy:main Nov 26, 2024
@lumberbot-app

lumberbot-app Bot commented Nov 26, 2024

Copy link
Copy Markdown

Owee, I'm MrMeeseeks, Look at me.

There seem to be a conflict, please backport manually. Here are approximate instructions:

  1. Checkout backport branch and update it.
git checkout v7.0.x
git pull
  1. Cherry pick the first parent branch of the this PR on top of the older branch:
git cherry-pick -x -m1 803c7bd20dae347d99aab8980119c364c5b48610
  1. You will likely have some merge/cherry-pick conflict here, fix them and commit:
git commit -am 'Backport PR #17315: SEC: fix security breaches in GHA workflows detected with zizmor'
  1. Push to a named branch:
git push YOURFORK v7.0.x:auto-backport-of-pr-17315-on-v7.0.x
  1. Create a PR against branch v7.0.x, I would have named this PR:

"Backport PR #17315 on branch v7.0.x (SEC: fix security breaches in GHA workflows detected with zizmor)"

And apply the correct labels and milestones.

Congratulations — you did some good work! Hopefully your backport PR will be tested by the continuous integration and merged soon!

Remember to remove the Still Needs Manual Backport label once the PR gets merged.

If these instructions are inaccurate, feel free to suggest an improvement.

@pllim

pllim commented Nov 26, 2024

Copy link
Copy Markdown
Member

@neutrinoceros backport would be nice but not critical, so if you don't feel like manual backporting, feel free to change milestone. Thanks!

@neutrinoceros

neutrinoceros commented Nov 26, 2024

Copy link
Copy Markdown
Contributor Author

I'll try a manual backport tomorrow !

@neutrinoceros neutrinoceros deleted the mnt/sec/fix_zizmor_detected_breaches branch November 27, 2024 07:26
@neutrinoceros neutrinoceros mentioned this pull request Nov 27, 2024
Merged
1 task
neutrinoceros pushed a commit to neutrinoceros/astropy that referenced this pull request Nov 27, 2024
@pllim @neutrinoceros
Backport PR astropy#17315: SEC: fix security breaches in GHA workflow…
daeac3f 
…s detected with zizmor

SEC: fix security breaches in GHA workflows detected with zizmor
(cherry picked from commit 803c7bd)
neutrinoceros pushed a commit to neutrinoceros/astropy that referenced this pull request Dec 10, 2024
@pllim @neutrinoceros
Backport PR astropy#17315: SEC: fix security breaches in GHA workflow…
099c859 
…s detected with zizmor

SEC: fix security breaches in GHA workflows detected with zizmor
(cherry picked from commit 803c7bd)
pllim added a commit that referenced this pull request Dec 10, 2024
@pllim
Merge pull request #17463 from neutrinoceros/bp/7.0.x/17315
1eafd90 
Backport PR #17315 on branch v7.0.x (SEC: fix security breaches in GHA workflows detected with zizmor)
@neutrinoceros neutrinoceros mentioned this pull request Dec 17, 2024
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@WilliamJamieson WilliamJamieson WilliamJamieson left review comments

@pllim pllim pllim approved these changes

@nstarman nstarman Awaiting requested review from nstarman

Assignees

No one assigned

Labels

dev-automation Extra CI Run cron CI as part of PR no-changelog-entry-needed testing utils.iers

Projects

None yet

Milestone

v7.0.1

Development

Successfully merging this pull request may close these issues.

5 participants

@neutrinoceros @pllim @WilliamJamieson @saimn @bsipocz